poll: resolve use-after-free + inconsistent callbacks call

This code was weird in the first place. I suspect my change will break something else
(probably the appcode that needed it). ssh_poll_ctx_free is not a good
place to send exception callbacks imho.
(cherry picked from commit b5351f2809140921076ef54cc6092b543b5199d2)

1 files changed, 3 insertions, 18 deletions

diff --git a/src/poll.c b/src/poll.c
index ca012d23..53c6b5c4 100644
--- a/src/poll.c
+++ b/src/poll.c
@@ -440,24 +440,9 @@ ssh_poll_ctx ssh_poll_ctx_new(size_t chunk_size) {
  */
 void ssh_poll_ctx_free(ssh_poll_ctx ctx) {
   if (ctx->polls_allocated > 0) {
-    register size_t i, used;
-
-    used = ctx->polls_used;
-    for (i = 0; i < used; ) {
-      ssh_poll_handle p = ctx->pollptrs[i];
-      socket_t fd = ctx->pollfds[i].fd;
-
-      /* force poll object removal */
-      if (p->cb && p->cb(p, fd, POLLERR, p->cb_data) < 0) {
-        if(ctx->polls_used < used) {
-            used = ctx->polls_used;
-        } else {
-            /* nothing to do */
-            i++;
-        }
-      } else {
-        i++;
-      }
+    while (ctx->polls_used > 0){
+      ssh_poll_handle p = ctx->pollptrs[0];
+      ssh_poll_ctx_remove(ctx, p);
     }
 
     SAFE_FREE(ctx->pollptrs);